I had a similar challenge for a client a few months ago where i had to automate the process of installing plugins and applying configuration for CI purposes.

I discovered it is key to obtain the desktop as the first api call after login for the session to become 'valid'.

So first jaxrs/logon, then jaxrs/getDesktop, then your service invoke.

A little sidenote: If you plan on having container managed authentication later on, the process will be different. The jaxrs/logon won't work, and instead the jaxrs/getDesktop will deliver the security_token.

A little remark though: wouldn't it be a better solution to have a shared library that you'd be able to use both from your Event Action as the ICN service?